ahmedsalah/kenda-communication-plugin
The package has a clear license, useful documentation, and repository tests. Its release and commit activity has stopped, while workflow weaknesses add avoidable supply-chain exposure.
42%
Total Score
50
92
25
Health Score Breakdown
All 12 analyzed action references are unpinned, and a high-confidence bot-conditions finding reports that actor context may be spoofable in the Dependabot auto-merge workflow. The audit found no untrusted checkout or script-injection sink, which limits but does not remove the risk.
The package has had no releases in the last 12 months, and its three releases were concentrated within about 10 days in February 2025. This indicates a prolonged lack of published maintenance.
The repository recorded zero commits and zero active maintainers in the last 3 months. The non-archived status does not compensate for the absent recent development activity.
The linked repository has no security policy. This reduces transparency for reporting and handling vulnerabilities, although the repository does use automated security scanning.
Vulnerabilities
We didn't find any vulnerabilities for this package.
Package versions
Maintainers
 Ahmed Salah |
Direct Dependencies
| Dependency | Last Release | Score |
|---|---|---|
 spatie/crypto Version ^2.1 | — | — |
illuminate/contracts Version ^10.0||^11.0 | — | — |
spatie/laravel-package-tools Version ^1.16 | — | — |
Weekly Downloads
Info
- Last Published
- 1 year ago
- Created
- 1 year ago
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.